[Demonstration 1]

[Buggy Method]
private void publish(final ExternalFile f, final Path hostPath) {
    Path filePath = hostPath.resolve(f.getItem().getUri().toPath());
    try {
        LOGGER.debug("Saving content to: " + filePath.toString());
        if (Files.notExists(filePath.getParent())) {
            Files.createDirectories(filePath.getParent());
        }
        if (Files.notExists(filePath)) {
            Files.createFile(filePath);
        }
        Files.copy(f.getContent().getDataAsBinaryStream(), filePath, StandardCopyOption.REPLACE_EXISTING);
    } catch (IOException ex) {
        LOGGER.error("Failed to write CDN file: " + filePath.toString(), ex);
    }
}

[Buggy Hunk]
if (Files.notExists(filePath.getParent())) {

[Patch]
if (filePath.getParent() != null && Files.notExists(filePath.getParent())) {

[Demonstration 2]

[Buggy Method]
@Override
protected synchronized Properties read() {
    long lastRead = lastModified();
    Properties allUsers = super.read();
    if (lastRead != lastModified()) {
        // reload hash cache
        cookies.clear();
        teams.clear();
        for (String username : allUsers.stringPropertyNames()) {
            String value = allUsers.getProperty(username);
            String[] roles = value.split(",");
            if (username.charAt(0) == '@') {
                // team definition
                TeamModel team = new TeamModel(username.substring(1));
                List<String> repositories = new ArrayList<String>();
                List<String> users = new ArrayList<String>();
                List<String> mailingLists = new ArrayList<String>();
                List<String> preReceive = new ArrayList<String>();
                List<String> postReceive = new ArrayList<String>();
                for (String role : roles) {
                    if (role.charAt(0) == '!') {
                        users.add(role.substring(1));
                    } else if (role.charAt(0) == '&') {
                        mailingLists.add(role.substring(1));
                    } else if (role.charAt(0) == '^') {
                        preReceive.add(role.substring(1));
                    } else if (role.charAt(0) == '%') {
                        postReceive.add(role.substring(1));
                    } else {
                        repositories.add(role);
                    }
                }
                team.addRepositories(repositories);
                team.addUsers(users);
                team.addMailingLists(mailingLists);
                teams.put(team.name.toLowerCase(), team);
            } else {
                // user definition
                String password = roles[0];
                cookies.put(StringUtils.getSHA1(username + password), username);
            }
        }
    }
    return allUsers;
}

[Buggy Hunk]
cookies.put(StringUtils.getSHA1(username + password), username);

[Patch]
cookies.put(StringUtils.getSHA1(username.toLowerCase() + password), username.toLowerCase());

[Demonstration 3]

[Buggy Method]
public static Result service(String ownerName, String projectName, String service, boolean isAdvertise) throws IOException, UnsupportedOperationException, ServletException {
    if (!isSupportedService(service)) {
        return forbidden(String.format("Unsupported service: '%s'", service));
    }
    Project project = Project.findByOwnerAndProjectName(ownerName, projectName);
    if (project == null) {
        return notFound();
    }
    models.User user = UserApp.currentUser();
    if (!isAllowed(project, service)) {
        if (user.isAnonymous()) {
            return BasicAuthAction.unauthorized(response());
        } else {
            // If you want the Git client showing your custom message to
            // the user, the Content-Type should be exact "text/plain"
            // without any parameter. For more details, see the code at
            // https://github.com/git/git/commit/426e70d4a11ce3b4f70636d57c6a0ab16ae08a00#diff-eea0ad565ec5903a11b6023755d491cfR154
            response().setHeader("Content-Type", "text/plain");
            return forbidden(String.format("'%s' has no permission to '%s/%s'.", user.name, ownerName, projectName));
        }
    }
    if (isAdvertise) {
        return ok(RepositoryService.gitAdvertise(project, service, response()));
    } else {
        if (request().body().isMaxSizeExceeded()) {
            return status(REQUEST_ENTITY_TOO_LARGE);
        } else {
            user.visits(project);
            return ok(RepositoryService.gitRpc(project, service, request(), response()));
        }
    }
}

[Buggy Hunk]
user.name, ownerName, projectName));

[Patch]
user.loginId, ownerName, projectName));